David
Howarth: If I may sum up the situation, I raised two
issues—scope and enforcement. The issue of scope breaks down
into two separate matters. One is whether assessment notices should
apply to purely private organisations such as Tesco, and the other is
whether they should apply to private organisations that are carrying
out public functions. As I understand it, the Government’s
position is that they are not willing to move on the former but are
considering moving on the latter. At the moment, there appears to be a
power to include private organisations carrying out public authority
functions, but no obligation to do so, and the Government are thinking
about the
situation. The
situation is therefore more encouraging than it might be, but it is not
fully there yet. Purely private organisations have immense power. We
should treat them as organisations with that much power when
thinking about how they ought to be regulated. The Government’s
argument about the market sorting it out is precisely the sort of
argument that we ought to be sceptical about, given the economic
situation that we are
in. Even
as a matter of economic theory, markets cannot work where people do not
have the information to make choices. It seems to me that the
Government have gone too far into a naive view of regulation and the
market. In fact, in some cases—this is an
example—regulation makes the market work better, because it
produces more information for consumers, rather than closing the market
down. On
the second issue, the Government’s position seems to be that the
Information Commissioner has enough powers already and that, as they
want to stick to a public sector view of assessment notices, there is
no need for extra enforcement powers. I find that disappointing, but I
ask the Government to consider the obvious point that if they extend
the assessment notice process to private sector organisations carrying
out a public function, their argument about enforcement no longer
applies, because they will no longer be dealing purely with
governmental organisations that they would expect to comply
automatically. At that point, they should consider again the question
of enforcement.
Mr.
George Howarth: Is the hon. Gentleman not in danger of
confusing data protection with the regulation of business? At times,
they may be similar but, actually, they are distinct
things.
David
Howarth: I do not think so. I am trying to ensure that
there is proper regulation of data protection, which sometimes involves
the regulation of some businesses, because businesses hold data. That
goes back to the point made by my hon. Friend the Member for Cardiff,
Central: we are talking about the enforcement of existing
obligations—they already apply—on the private sector, not
about changing
obligations. Will
the Government reconsider their position on enforcement as a
consequence of reconsidering their position on scope? The two things
are connected. I do not wish to detain the Committee further. I am
sufficiently encouraged by the Government’s movement on private
sector bodies carrying out public functions that I beg to ask leave to
withdraw the amendment.
Mr.
Bellingham: I always listen carefully to the Minister.
Obviously, there is a developing agreement between us on how the
private sector should be controlled when it comes to assessment
notices. She made a good point about section 41 of the Data Protection
Act
1998.
Alun
Michael: On a point of order, Mr. Cook. I may
have lost track, but I thought that the hon. Member for Cambridge had
withdrawn his amendment. Did that not close the
debate?
The
Chairman: Let me clarify the situation for the Committee.
I am yet to put the withdrawal to the Committee. At the moment, I am
allowing the hon. Member for North-West Norfolk to make his points,
which I hope he will do briefly.
Mr.
Bellingham: I will be brief, Mr. Cook, because
the Minister has given us some encouragement. I hope that she will
reply to me on the powers that will be included. Obviously, private
sector organisations that are in contracts with various Departments and
agencies are not necessarily included, but the powers to include them
exist. I would be grateful if in due course we could have a discussion
about that, perhaps in
writing. I
take on board what the Minister said about new clause 32, but I urge
her to push on with as much speed as possible to introduce the changes
made by the other place to the Criminal Justice and Immigration Act
2008.
David
Howarth: I beg to ask leave to withdraw the
amendment.
Amendment,
by leave, withdrawn.
Mr.
Bellingham: I beg to move amendment 372, in
clause 151, page 99, line 30, leave
out ‘without the approval of the Secretary of State’ and
insert ‘until the code has been approved by a
resolution of each House of
Parliament’.
The
Chairman: With this it will be convenient to discuss the
following: amendment 367, in clause 153, page 107, leave
out lines 37 and 38 and
insert— ‘(4) The code must
not be issued by the Commissioner until a statutory instrument
containing the draft code has been approved by a resolution of each
House of
Parliament.’. Amendment
368, in
clause 153, page 107, line 40, after
‘must’, insert
‘not’. Amendment
369, in
clause 153, page 107, line 44, after
‘is’, insert
‘not’. Amendment
370, in clause 153, page 108, leave out
lines 8 to
14. Amendment
371, in
clause 153, page 108, line 17, after
‘under’, insert
‘annual’.
Mr.
Bellingham: The amendments ensure that a resolution of
both Houses of Parliament is in place before the Information
Commissioner issues the code of practice on enforcement notices. Clause
151 states that it is up to the Secretary of State to approve the code
of practice, but why should there not be an affirmative resolution of
both Houses? Why is Parliament being downgraded? Surely the affirmative
resolution procedure should be in
place. We
are talking about the code of practice on assessment notices, the
importance of which we have already discussed. The code of practice is
an important tool in the commissioner’s armoury in ensuring that
we have better data protection in this country. Before the commissioner
issues the code of practice, it should be subject to affirmative
resolution. Why can that not happen? We are increasingly using the
affirmative resolution procedure, which is good for Parliament, so I
humbly suggest to the Minister that the amendments are positive. Why
should the Secretary of State have the power, and why should Parliament
not have more
power? We
are discussing a very important part of what will be the interface
between our constituents, their private data and lives and Her
Majesty’s Government—a Government who are taking upon
themselves more
powers, and want to interfere more in, and look at more aspects of, our
lives and to have more control over our data. Surely, Parliament, not
the Secretary of State, should be the ultimate
sanction. Bridget
Prentice: Much as I would like to be positive towards the
hon. Gentleman on this matter, given the relative narrow scope of the
code, I am not persuaded that it needs to be subject to the
parliamentary procedure that he has outlined. Obviously, the other
amendments would also make the data-sharing code of practice subject to
the affirmative
procedure. The
Bill states that a draft data-sharing code must be laid before
Parliament within 40 days, unless either House resolves not to approve
the draft. Of course, we recognise that the code is important, given
the need to provide clear, authoritative guidance to practitioners,
which is why we have provided for the equivalent of the negative
resolution procedure. That is probably the appropriate level of
parliamentary scrutiny for what is, after all, a code of practice,
rather than a statutory order, regulations or rules. If we have
misjudged the level of scrutiny for the two codes of practice, I shall
look with interest and pay close attention to what the Delegated Powers
and Regulatory Reform Committee says when it considers the matter. We
will, of course, consider its recommendations very
carefully. Amendment
371 would oblige the information commissioner to keep the code of
practice under “annual” review. Proposed new section 52C
to the Data Protection Act, inserted by clause 153, obliges the
commissioner to keep the code under review, and he is also required to
update the code if he becomes aware that its content could result in
the UK breaching any of its Community or international obligations. It
is possible to read amendment 371 as preventing the code
from being amended quickly, once a breach has been identified, whereas
proposed new section 52C gives the information commissioner the scope
to reconsider and review the code as and when he sees fit. Given his
role as the independent data protection regulator, we think that that
is right and that tying them to an annual review would be unnecessarily
restrictive.
Mr.
Kidney: I am sorry to slow my hon. Friend’s
progress through amendment 371, but I want to return to amendment 372.
She has answered the point about parliamentary approval of the code,
but the other part of the amendment raised the question why the
Secretary of State should have to give permission for the code to be
issued in the first place. The Information Commissioner warned us that
that is a dangerous imposition and fetter on his independence from
Government. What is the justification for the Secretary of State
approving the issue of the code in the first
place?
Bridget
Prentice: My hon. Friend makes a fair point. The reason is
that it gives the opportunity to ensure consistency across Whitehall
Departments in relation to data protection matters. It also ensures
that the burden on public bodies is both proportionate and fair. That
is why it is in the hands of the Secretary of
State.
Mr.
Garnier: That is not an answer to the hon.
Gentleman’s question. Consistency can be policed or applied by
the commissioner, who has a wider remit than the Secretary of State
across Whitehall. The Secretary
of State will be concerned primarily with his own Department. If he
starts interfering with other people’s Departments, I dare say
that jealous Ministers will complain. Surely the hon.
Gentleman’s point needs to be considered rather more carefully
than the Minister’s argument
demonstrated. 10.15
am
Bridget
Prentice: I am terribly sorry if the hon. and learned
Gentleman thinks that I did not consider my hon. Friend’s
question seriously enough. It is the answer to the question, but
whether it is the answer that either the hon. and learned Member for
Harborough or my hon. Friend wanted to hear is another matter. However,
if it is something about which members of the Committee feel strongly,
I am happy to reflect on it and see whether the responsibility should
be handed over to the Information Commissioner rather than the
Secretary of State. It is not something on which I intend to go to the
wall about, but I will certainly have another look. The Delegated
Powers and Regulatory Reform Committee in the other place still has to
scrutinise that part of the Bill, and I shall pay close attention to
what it says on the
subject.
Mr.
Garnier: May I say how grateful I am to the
Minister?
Bridget
Prentice: I am deeply delighted that the hon. and learned
Gentleman is grateful to me, at least until the end of
today.
Mr.
Bellingham: On a dull Thursday morning, I regard the
Minister’s commitment to look at the matter and to talk to the
Delegated Powers and Regulatory Reform Committee as a minor triumph. I
shall quit while I am ahead. I beg to ask leave to withdraw the
amendment. Amendment,
by leave,
withdrawn. Clause
151 ordered to stand part of the
Bill.
Clause
152Information
sharing
David
Howarth: I beg to move amendment 49, in
clause 152, page 100, line 7, leave
out ‘any person’ and insert ‘an appropriate
person’.
The
Chairman: With this it will be convenient to discuss the
following: amendment 50, in clause 152,
page 100, line 8, at end
insert— ‘(1A) No
information-sharing order may authorise data to be shared in any way
that might result in the date being used for a purpose different from
that for which its collection was originally
authorised.’. Amendment
51, in
clause 152, page 100, line 9, at
end insert— “‘an
appropriate person” means any public authority within the
meaning of section 6 of the Human Rights Act 1998, and, for the
purposes of that section, any use of data under an information sharing
order shall count as exercising a function of a public nature and shall
in no circumstances count as an act whose nature is
private;’. Amendment
52, in clause 152, page 100, leave out
lines 24 and 25.
Amendment 53,
in
clause 152, page 100, line 27, leave
out ‘it is satisfied’ and insert ‘the following
conditions are
met’. Amendment
54, in clause 152, page 100, leave out
lines 29 to 32 and
insert— ‘(a) the order will
not authorise data to be used in any way that implies any new
government policy or any deviation from previously announced government
policy, and “government policy” in this section means
only that policy to which there is clear and unambiguous reference in
the speeches or other remarks of Ministers during the passage of a bill
or bills in Parliament, (b) the
order is proportionate to the policy objective it seeks to further,
and’. Amendment
356, in
clause 152, page 100, line 30, leave
out ‘secure a relevant policy objective’ and insert
‘serve the public
interest’. Amendment
55, in
clause 152, page 100, line 33, leave
out from ‘order’ to end of line 35 and insert
‘does not, other that with that person’s
consent, interfere with or restrict any person’s right to or
interest in privacy, whether that right or interest arises under any
statute or at common law or in any other
way.’. Amendment
56, in
clause 152, page 100, line 41, at
end insert— ‘(5A) No
information-sharing order shall be made unless the authority making the
order identifies and publicly declares which existing government policy
the order would further, the evidence for the existence of that policy
in the speeches or remarks of Ministers during the passage of bills in
Parliament and a statement of how the order will further that
policy.’. Amendment
57, in
clause 152, page 101, line 8, at
end insert ‘, except that such person must be
a public authority for the purposes of section 6 of the Human Rights
Act, and no power granted under this subsection shall be used to
authorise any person further to share
data;’. Amendment
58, in clause 152, page 101, leave out
lines 13 and
14. Amendment
59, in clause 152, page 101, leave out
lines 18 and
19. Amendment
61, in clause 152, page 101, leave out
line 22 and
insert— ‘(h) modify any
statutory instrument made under the Data Protection Act or any
statutory instrument made under any other enactment, but may not modify
any statute or any rule of common
law.’. Amendment
60, in clause 152, page 101, leave out
line
22. Amendment
147, in
clause 152, page 103, line 13, at
end insert ‘and (c) undertake a
privacy impact
assessment.’. Amendment
357, in
clause 152, page 103, line 13, at
end insert ‘and (c) supply a full
privacy impact
assessment.’. Amendment
148, in
clause 152, page 103, line 14, after
‘order’, insert ‘and privacy impact
statement’. Amendment
149, in
clause 152, page 103, line 18, at
end insert ‘and comment on the compatibility
of the proposals with all data protection requirements laid down in
statute.’.
| 
